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Can I check the COVID Certificates of customers or visitors to my 
premises? [DATA CONTROLLERS] 


It is your responsibility as the owners/operators of a premises, as a data controller, to 
establish whether you have an identified legal basis to ask for, and verify, the 
vaccination status of attendees or patrons. This should be determined with reference to 
the current advice of the public health authorities, and personal data should be 
processed only as necessary to meet the requirements of that advice. 


The current Government public health advice sets out the conditions under which 
access to various activities, events and mass gatherings can be provided based on 
reduced capacity and/or COVID-19 vaccination or immunity status: 


https://www.gov.ie/en/press-release/7894b-post-cabinet-statement-resilience-and- 
recovery-the-path-ahead 


The implementation of some of these measures will require the verification of either 
COVID-19 vaccination or immunity status by the owners/operators of premises hosting 
events or activities. In seeking to implement the requirements of the conditions set out 
by the public health authorities, owners/operators of premises may lawfully process 
personal data in limited circumstances. Section 53 of the Data Protection Act 2018 
provides that special categories of personal data, which includes data revealing 
vaccination status, may be processed where necessary for public interest purposes in 
the area of public health. The determination of necessity in this context should be 
made with strict reference to the up-to-date advice of the public health authorities, and 
any data processing should be strictly limited to meeting the specific requirements of 
this advice and continue only for as long as any such advice is in place. You should 
check frequently what conditions apply specifically to your type of business or event. 


In addition to this, the owners/operators or relevant premises for the purposes of the 
Health Act 1947 (Sections 31AB and 31AD) (Covid-19) (Operation of certain indoor premises) 
Regulations 2021 have an additional legal basis to process data revealing vaccination 
status. The Regulations place a legal obligation upon the operators of relevant indoor 
premises to verify patrons’ vaccination status, subject to enforcement by authorised 
compliance officers. Where an operator of a relevant indoor premises fails to comply 
with the requirements of the Regulations, they may be guilty of an offence. 
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Personal data processed in this context is subject to all of the requirements of the 
GDPR. Please see our guidance for data controllers for specific information on data 
security, retention of data, and the rights of individuals. 


https://www.dataprotection.ie/en/organisations/know-your-obligations 


Who can check my vaccination status? [DATA SUBJECTS] 


Under current public health guidelines, the owners/operators of certain premises 
hosting indoor events and mass gatherings may be required to verify your vaccination 
status to allow entry. This is provided for in law by Section 53 of the Data Protection Act 
2018, which allows the processing of personal data, including health data, for public 
health purposes. 


The Government's public health guidelines indicate which categories of businesses and 
events are required to check vaccination status: 





https://www.gov.ie/en/press-release/7894b-post-cabinet-statement-resilience-and- 
recovery-the-path-ahead/ 





Some examples of premises, other than hospitality premises, that are currently 
required to check vaccination status in line with Government guidelines would be: 


e Cinemas 

e Museums 

e Entertainment venues 
e Bowling Alleys 

e Snooker Halls 

e Activity centres 


The processing of personal data in this context should be limited to verifying your 
vaccination status, and there is currently no requirement for any further processing of 
your information for public health purposes. Where vaccination status is verified by 
scanning a certificate with an official app, no personal data will be retained by the 
owner/operator of the premises, and no personal data will be shared with any third 
parties. The owners/operators of premises or events are not required to demonstrate 
that they have carried out a data protection impact assessment, as the scope of the 
processing is limited and based upon public health requirements. Neither is it the case 
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that health data, such as vaccination status, may only be processed by a medical 
professional. 


The operators of relevant premises for the purposes of the Health Act 1947 (Sections 
31AB and 31AD) (Covid-19) (Operation of certain indoor premises) Regulations 2021 have an 
additional legal basis to process data revealing vaccination status. This legal basis 
applies to indoor hospitality premises such as pubs, restaurants, cafés etc... and is part 
of a mandatory and enforceable regime, whereby the owners of relevant premises are 
subject to inspection and may face prosecution for failure to comply. 


Please see our separate guidance note on the processing of vaccination data in the 
context of employment for information about employers’ asking for verification of 
vaccination status. 





